Hi all

I got a backdoor.trojan on my PC, so I scanned my PC with Norton AV and several other TrojanRemove Tools. I’ve deleted all files that were infected and removed also the registry adds.
Now, all my antivirus and antitrojan tools can’t find anything on my PC but since I had this Trojan, ZoneAlarm alerts me every time I access the web, that a program (called mnsvcsp.exe) wants to access the web. I deleted any files that I could find with this name. Although the program remains anywhere, cause it continuous to access the internet (according to ZoneAlarm) anytime I go online.
I couldn’t find any information about this program mnsvcsp.exe on the web and I don’t know how to remove this file completely from my PC. Can anybody help me?
Thank you

Disable system restore, then delete the program. System restore most likely put it back in so its still there. Im no XP expert so maybe someone else will chime in on this.

Hi undee, thanks for your answer

I’ve already disabled system restore and, as I mentioned above, there isn’t any virus or trojan on my PC (according to Norton and several antitrojan tools) and I can’t find any file named mnsvcsp.exe on my PC although ZoneAlarm alerts that this program wants to access the web.

Hello Zimmi74,
watch that, maybe interisting information for you.....:
http://pub75.ezboard.com/fsimplesupportfrm58.showMessage?topicID=115.topic
I think you made the mistake to delete manually files said as corrupted !!!
In the program Trojan Remover, you have this function automatic....
Remember that with Trojan's viruses, you have not only to delete files, but also to destroy and eradicate the "Worm" the program isntalled into your hard-drive made to give the hackers the way to control your computer.
The fact there is still a program asking for access to internet mean you still have the "Worm" embaded to your system,
recent Trojan virus Bugbear is using a random procedure to mistake any anti-virus program to detect it.
I invite you to download Trojan Remover 4.90 which is a program to detect the two parts of a trojan virus: the "spread" and the "worm". This program is a freeware for one month, then shareware if you want to keep it and update the database of trojan's signatures. Excellent program
Trojan Remover at:
http://www.simplysup.com/tremover/details.html

hi zimmi74,
you may have a trojan, this trojan may be a keylogger collecting, passwords, credit card numbers and sends them via mail to the person who created it.
This trojan name is backdoor sclog20. try pc cilin it may detect it. go to www.trendmicro.com
download the free trial, and scan your computer. if you don't want to download the program, try their free house call and scan your computer,
it would also be a good idea to go to www.thepublicworks.com security section and link to Regprot download a free registry monitor, and from Sysinternals, their free port and process monitors (TDImon, and Process Explorer)
link also to wilders.org and download a free 30 day trial of Trojan Hunter and scan your computer.
take care,
murve

Hi Zimmie74
I have the same problem wit mnsvcsp.exe
Its nowere to be found, and I think it re-copies it selves at each start up.
Mine tries to access the following IP: 193.70.192.54, its an Italian adress near Rome.
Whats your torjan try to access? I just wanna to verify if we have the same s---.
I have not found one virus scanner that recognises this. :(

Got this app through Kazaa today- NPF 2003 alerted me of its existance and attempt to access the net. Found it running in memory- killed it. Found it in one of the startup locations (used Mike Lin's utility)- deleted it. Found an EXE and a DLL in the system directory- deleted those as well. Found a prefetch file under the prefetch subdirectory- deleted it as well. NAV 2003 said nothing all the while... Meanwhile no other attempts to access the net, and I am downloading PC Cillin as I write.

PC Cillin wanted me to uninstall NAV, so I passed and did an online check at TrendMicro instead. Still waiting for the reusults... Meanwhile I deleted the following registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
(based on TrenMicro's suggestion for SCLOG.20 posted before).

CORRECTION!!! I deleted the mnsvcsp subkey UNDER the posted entry, not the whole entry.

! SORRY !

TDS Trojan Defence Suite also detects this keylogger ;)

Ybs is right on! Delete all registry keys related to "mnsvcsp", reboot, then delete mnsvcsp.exe and mnsvcsp.dll

I'm suprised Norton AV 2003 did not detect this. Only idea I was infected was NAV scanning an outgoing transmission every 5 minutes or so. I got this trojan from a 60KB file called "Age of Mythology Cheats". Stupid me!

hi people

i have the same problem with mnsvcsp.exe.
i didn`t find the file till i made all files visible. after i found it in windows\system32. i converted the file to mnsvcsp.txt and then i read the code. some parts are readable. its very interessting.
there is an url --> http://soft-central.net